AiutoComputerHelp HTTP Header Audit checks HTTP response headers returned by the current WordPress site and highlights security controls that deserve review.<\/p>\n\n
The plugin is intentionally read-only. It does not modify WordPress, .htaccess, Apache, Nginx, CDN, reverse proxy, browser policies, or server configuration.<\/p>\n\n
Version 0.3.1 keeps the validated 0.3-series audit behavior unchanged and updates the plugin name, slug, and translation domain for WordPress.org review. The existing checks cover: HTTPS, HTTP-to-HTTPS redirection, redirect-chain integrity, HSTS, Content-Security-Policy, CSP Report-Only, clickjacking protection, X-Content-Type-Options, Content-Type and charset, Referrer-Policy, Permissions-Policy, COOP, COEP, CORP, cross-origin isolation prerequisites, basic CORS exposure, Cache-Control, cookie attributes, information disclosure headers, selected obsolete security headers, and obvious conflicting singleton policies.<\/p>\n\n
CSP analysis looks beyond presence or absence. It reviews high-signal conditions such as unsafe-eval, unsafe-inline without a nonce or hash, wildcard script sources, object-src, base-uri, and frame-ancestors.<\/p>\n\n
The audit uses four result states: Pass, Review, Warning, and Info. A missing header is not automatically a vulnerability, and a present header does not prove that a site is secure. Some policies are application-specific deployment choices. The plugin intentionally does not calculate a numeric security score.<\/p>\n\n
For safety, the audit accepts only URLs on the current WordPress site's host and follows redirects only while they remain on that host.<\/p>\n\n
Cookie auditing checks objective Set-Cookie attribute relationships and prefix requirements without exposing cookie values. The absence of Secure, HttpOnly, or SameSite is not automatically treated as a vulnerability because the correct choice depends on the cookie's purpose.<\/p>\n\n
Active origin-reflection probing, preflight simulation, deep CORS authorization testing, Clear-Site-Data, scheduled monitoring, and configuration suggestions remain outside the scope of this plugin. Basic CORS analysis validates response-header syntax and a few objective incompatibilities without assuming that public wildcard access or a specific allowed origin is inherently unsafe.<\/p>\n\n\n
\/wp-content\/plugins\/<\/code> or install the ZIP from the WordPress Plugins screen.<\/li>\n- Activate the plugin.<\/li>\n
- Open Tools > AiutoComputerHelp HTTP Header Audit.<\/li>\n
- Run the audit against the site's public URL or another URL on the same host.<\/li>\n<\/ol>\n\n\n
\nDoes this plugin change my security headers?<\/h3><\/dt>\nNo. The plugin is read-only.<\/p><\/dd>\n
Is a Warning or Review result proof that my site is vulnerable?<\/h3><\/dt>\nNo. The report identifies configurations that deserve review. Security headers are only one layer of web security, and several policies are application-specific.<\/p><\/dd>\n
Why is missing HSTS shown as Review instead of an automatic failure?<\/h3><\/dt>\nHSTS provides valuable downgrade protection, but enabling it is a deployment decision with compatibility implications. The plugin reports the absence and evaluates the policy when present without assuming that every site must use the same deployment strategy.<\/p><\/dd>\n
Does a present CSP automatically pass?<\/h3><\/dt>\nNo. The plugin also checks several high-signal CSP weaknesses and missing hardening directives. CSP is complex, so this remains an audit aid rather than a formal CSP validator.<\/p><\/dd>\n
Can I scan another website?<\/h3><\/dt>\nNo. The target is deliberately restricted to the current WordPress site's host to reduce SSRF risk and keep the plugin focused on self-auditing.<\/p><\/dd>\n
Does the plugin send data to an external service?<\/h3><\/dt>\nNo. The scan is performed by the WordPress server against its own site URL. No analytics or external API is used.<\/p><\/dd>\n\n<\/dl>\n\n\n
0.3.1<\/h4>\n\n\n- Rename the plugin to AiutoComputerHelp HTTP Header Audit and align the requested WordPress.org slug and text domain.<\/li>\n
- Keep the validated read-only same-host audit behavior unchanged.<\/li>\n<\/ul>\n\n
0.3.0<\/h4>\n\n\n- First stable release of the validated 0.3 series.<\/li>\n
- Preserve the read-only same-host request boundary and the validated header, cookie, cross-origin, CORS, and redirect-chain audit behavior.<\/li>\n
- Finalize WordPress.org release metadata and the translation template without changing audit classifications or request behavior.<\/li>\n<\/ul>\n\n
0.3.0-beta1<\/h4>\n\n\n- Promote the validated 0.3.0-alpha6 baseline to beta without changing audit classifications or request behavior.<\/li>\n
- Keep the read-only same-host request boundary and all validated header, cookie, cross-origin, CORS, and redirect-chain checks unchanged.<\/li>\n
- Synchronize plugin, readme, and translation-template version metadata for beta testing.<\/li>\n<\/ul>\n\n
0.3.0-alpha6<\/h4>\n\n\n- Preserve all alpha5 redirect classifications and request-boundary behavior.<\/li>\n
- Guarantee a non-empty assessment for every Redirect-chain Integrity result, including completed chains with four or more redirects.<\/li>\n
- Add regression coverage that verifies redirect assessments are always populated.<\/li>\n<\/ul>\n\n
0.3.0-alpha5<\/h4>\n\n\n- Add Redirect-chain Integrity without changing the existing header, cookie, cross-origin policy, or CORS classifications.<\/li>\n
- Detect HTTPS-to-HTTP downgrade redirects, loops, unsupported redirect schemes, missing Location targets, and excessive redirect chains.<\/li>\n
- Review cross-host redirect targets without following them, preserving the plugin's same-site SSRF boundary.<\/li>\n
- Keep direct responses informational and short, coherent same-host chains as Pass.<\/li>\n
- Increase only the hard redirect trace ceiling for pathological same-site chains so long-chain diagnostics can be reported safely.<\/li>\n<\/ul>\n\n
0.3.0-alpha4<\/h4>\n\n\n- Add a conservative Basic CORS Exposure check without altering the existing alpha3 controls.<\/li>\n
- Validate Access-Control-Allow-Origin as a single origin, *, or null and review the special null origin case.<\/li>\n
- Validate the case-sensitive Access-Control-Allow-Credentials: true value and flag wildcard-origin plus credentials as incompatible for credentialed CORS.<\/li>\n
- Validate Access-Control-Allow-Methods and Access-Control-Allow-Headers token lists and review wildcard use with credentials.<\/li>\n
- Report Vary: Origin context for explicit origins without treating its absence as an automatic error for fixed single-origin policies.<\/li>\n
- Keep valid public wildcard CORS informational because public non-credentialed resources may intentionally use it.<\/li>\n<\/ul>\n\n
0.3.0-alpha3<\/h4>\n\n\n- Add read-only checks for Cross-Origin-Opener-Policy (COOP), Cross-Origin-Embedder-Policy (COEP), and Cross-Origin-Resource-Policy (CORP).<\/li>\n
- Recognize current COOP tokens including noopener-allow-popups.<\/li>\n
- Validate COEP require-corp, credentialless, unsafe-none, and an optional report-to parameter.<\/li>\n
- Add a conservative cross-origin isolation summary based on COOP, COEP, and Permissions-Policy cross-origin-isolated.<\/li>\n
- Keep missing cross-origin policies informational because these controls are application-specific and can affect popup or cross-origin resource behavior.<\/li>\n<\/ul>\n\n
0.3.0-alpha2<\/h4>\n\n\n- Refine cookie prefix diagnostics: distinguish a missing Secure attribute from a non-HTTPS origin.<\/li>\n
- Treat localhost, 127.0.0.1, and ::1 as local development contexts for the origin-scheme diagnostic only. Secure remains mandatory for __Secure-, __Host-, __Http-, and __Host-Http- style prefixes.<\/li>\n<\/ul>\n\n
0.3.0-alpha1<\/h4>\n\n\n- Add a read-only Cookie Security Audit without changing the 0.2.3 header-analysis logic.<\/li>\n
- Never expose cookie values in the report; only cookie names and selected attributes are shown.<\/li>\n
- Warn on SameSite=None without Secure and Partitioned without Secure.<\/li>\n
- Validate __Secure-, __Host-, __Http-, and __Host-Http- prefix requirements conservatively.<\/li>\n
- Review repeated security-relevant cookie attributes.<\/li>\n
- Keep generic absence of Secure, HttpOnly, or SameSite informational because cookie purpose is application-specific.<\/li>\n<\/ul>\n\n
0.2.3<\/h4>\n\n\n- Validate Cache-Control directive syntax and standard directive values instead of treating header presence alone as sufficient.<\/li>\n
- Warn on malformed standard directives such as non-numeric max-age and s-maxage values.<\/li>\n
- Review extension-only policies and request-oriented directives observed in responses without treating unknown extensions as invalid syntax.<\/li>\n
- Preserve conservative context-dependent handling for otherwise valid cache policies.<\/li>\n<\/ul>\n\n
0.2.2<\/h4>\n\n\n- Validate Permissions-Policy directive and allowlist syntax instead of treating header presence alone as a pass.<\/li>\n
- Recognize empty, self, quoted-origin, and wildcard allowlists conservatively.<\/li>\n
- Warn when no valid directive is present, review mixed valid\/malformed directives, and review wildcard policies.<\/li>\n<\/ul>\n\n
0.2.1<\/h4>\n\n\n- Validate Referrer-Policy values instead of treating header presence alone as a pass.<\/li>\n
- Recognize all standard Referrer-Policy tokens and comma-separated fallback lists.<\/li>\n
- Evaluate the last recognized policy token as the effective policy.<\/li>\n
- Warn when no recognized policy is present and review mixed recognized\/unrecognized policy lists.<\/li>\n<\/ul>\n\n
0.2.0<\/h4>\n\n\n- Added Pass, Review, Warning, and Info result states.<\/li>\n
- Added priority labels without introducing a numeric security score.<\/li>\n
- Added HTTP-to-HTTPS redirect checking.<\/li>\n
- Added Content-Type and charset review.<\/li>\n
- Added conservative Cache-Control analysis.<\/li>\n
- Expanded CSP analysis for script sources, unsafe-eval, unsafe-inline, wildcards, object-src, base-uri, and Report-Only.<\/li>\n
- Improved HSTS analysis, including staged max-age handling and preload prerequisite review.<\/li>\n
- Added legacy header checks for X-XSS-Protection, HPKP, and Expect-CT.<\/li>\n
- Added information disclosure review for Server and X-Powered-By.<\/li>\n
- Added basic consistency checks for selected singleton security policies.<\/li>\n
- Deferred COOP, CORP, COEP, detailed CORS, and cookie auditing to later versions.<\/li>\n<\/ul>\n\n
0.1.0<\/h4>\n\n\n- Initial experimental release.<\/li>\n
- Read-only same-site HTTP security header audit.<\/li>\n<\/ul>","raw_excerpt":"Read-only audit of HTTP security headers and related same-site HTTPS behavior returned by your WordPress site.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/pl.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/381243","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/pl.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/pl.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/pl.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=381243"}],"author":[{"embeddable":true,"href":"https:\/\/pl.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/aiutocomputerhelp"}],"wp:attachment":[{"href":"https:\/\/pl.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=381243"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/pl.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=381243"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/pl.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=381243"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/pl.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=381243"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/pl.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=381243"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/pl.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=381243"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}